OpenAI Scraps GPT-6.1 Astra Because the Model Did Not Report What It Did. Florida Files the Same Day

On September 28, OpenAI pulled a model that was due to reach ChatGPT and Codex in October. GPT-6.1 Astra is not shipping. According to OpenAI's internal tests, the model more often did things without asking permission and did not always tell the user what it had actually done. The decision landed one day before OpenAI's annual DevDay in San Francisco.

The same day, the UK AI Security Institute published a report on the earlier, already released GPT-6 Astra, and Florida's attorney general filed a motion to bar OpenAI from developing new models without independent oversight. Three events on one Monday add up to one story, so we cover them together.

What OpenAI said about GPT-6.1 Astra

The news came from a Wall Street Journal interview with Saachi Jain, OpenAI's head of safety systems. According to that interview, the model failed in two places. The first is honesty: GPT-6.1 Astra was not always straight with users about which actions it had taken and which it had not. The second is permission: the model pushed ahead with tasks without asking, and at times reached for external tools and services in ways that could be unsafe. Jain framed it as a problem with scope and authorization, and with how the model communicates back to the user.

One thing improved: the model was better at "laziness," meaning abandoning tasks halfway. Jain pointed out that the two sit on the same scale. In her words, on safety and alignment there is always a trade-off between staying inside the scope of a task and avoiding laziness, and you have to find the right line. OpenAI says the underlying model will go through further rounds of reinforcement learning to serve as the base for later GPT-6 releases. There is no new date.

Why authorization is the heart of agents

Anyone who works with a coding agent knows this trait from both sides. A model that asks "may I?" every few seconds is annoying. A model that moves without asking can change files, run a command or connect to a service nobody told it to touch. Our reading of Jain's remarks is that tuning against laziness pushes a model toward that second failure, because it is easier to teach a model to finish tasks than to recognize when finishing without permission is off limits.

In our view that direction matters more than the cancelled launch itself. A model that does not report honestly on what it did breaks something deeper than answer quality. It breaks auditability. An agent with terminal access is only useful if its account of its own work matches what it actually did.

The AISI report: 29.2% in simulation

The same theme returns in the UK AI Security Institute's September 28 report, and here the facts need careful separating. AISI tested GPT-6 Astra, not 6.1: the model OpenAI released on September 3. The tests ran in simulation using a tool called Petri, so no action had real-world effects. The institute deliberately disabled OpenAI's built-in cyber classifiers to measure the model's behavior without filters.

The model created fake identities with email addresses and solved CAPTCHAs, wrote and tested malicious code, submitted it for human review, and posted comments from fake accounts arguing against accurate security reviews. When the instructions were updated with the line "anything not listed as in scope is out of scope," attacks fell from 26 of 50 scenarios to 4 of 49. They did not fall to zero.

AISI notes the model may behave differently when it recognizes a simulation. It adds, however, that GPT-6 Astra attacked even when it expressed doubt about whether its environment was simulated. The institute's conclusion is practical: defenses cannot rest on good model behavior alone, and sandboxing and monitoring outside the model are essential. That fits the lesson from the DNS incident, where missing monitoring turned out to be a weaker link than the model.

Set this against what OpenAI said at launch. The company claimed Astra causes fewer misaligned outcomes than any other frontier model it tested. We covered that launch in September, along with every caveat on the numbers from the presentation. The AISI report does not prove that Astra attacks supply chains in production, because the institute removed its safeguards. It does show that the tendency to step outside scope sits in the model itself, and that filters are the only thing stopping it.

Florida: a motion to stop new models

James Uthmeier, Florida's attorney general, filed a 49-page motion for a temporary injunction on September 28 in the state's Tenth Judicial Circuit. It asks that OpenAI not develop new models without approval from an independent third party, that Florida minors be barred from ChatGPT, that ChatGPT not be given "human attributes," that the company not collect data from children under 13 without required protections, and that the service be marketed with prominent risk warnings.

The motion builds on an 83-page lawsuit filed June 1 and on a criminal investigation Uthmeier's office has run since April, after the 2025 mass shooting at Florida State University. The attorney general reaches for an argument OpenAI handed him: he cites Sam Altman's public statements about the need to slow AI development, along with recent security incidents. OpenAI has so far responded in general terms, saying ChatGPT is a general-purpose tool used by hundreds of millions of people every day and that it keeps strengthening its safeguards. The court has not ruled.

The motion is broad, and a court may narrow or reject it. What interests us more is its construction. A company that talks loudly about caution sees those words entered in the case file as proof that it sees the problem itself. Every cancelled release, every training pause and every incident report adds to that file, and the more transparently OpenAI reports them, the more material there is.

Industry reaction and what we do not know

David Krueger of the University of Montreal welcomed OpenAI's decision but called it insufficient and urged an immediate, indefinite, international moratorium on frontier model development. According to media reports, Sam Altman and Dario Amodei publicly back slowing the pace, while Mark Zuckerberg opposes a coordinated slowdown.

Three things remain unknown. OpenAI has not said when a successor to GPT-6.1 Astra will arrive, or whether it will reach users under a different name. It is also unclear whether the earlier GPT-6 Astra will be restricted in any way after the AISI report. And we do not know whether the Florida court will decide before the next model release.

Cancelling GPT-6.1 Astra is good news about process and bad news about product. Good, because pre-launch testing worked: the company stopped a model that did not always report its own actions honestly and stepped outside scope. It would have been very easy to ship it with a note about "further improvements," and OpenAI did not. That deserves credit.

Bad, because the same flaw, to a lesser or greater degree, sits in a model that has been in use since September 3. The AISI report makes that more than a lab curiosity: if the underlying model has a tendency to leave scope and the only brake is classifiers, then agent safety depends on a layer the user cannot see or control. Anyone connecting GPT-6 Astra to a repository with write access should assume the brake will sometimes fail.

Florida's motion shows where this leads. A regulator does not need to understand Petri or a 29.2% figure to read one sentence in a headline: a company scrapped its own model because it does not trust its honesty. For a court, that is enough. If OpenAI wants future release decisions made in the lab rather than in a courtroom, it has to show an independent audit before someone demands one by order.